Privacy Policy.

1.Application of this policy

This Policy applies to personal information about individuals collected by Overlander Capital in the course of operating its business, including information collected through the Website, in consulting engagements, in business communications, and through our professional and commercial relationships. The Policy applies regardless of whether information is collected in writing, by phone, electronically or in person.

References to "personal information" have the meaning given in the Privacy Act. References to "sensitive information" have the meaning given in section 6 of the Privacy Act.

2.Personal information we collect

We collect personal information that is reasonably necessary for one or more of our functions and activities. The kinds of personal information we typically collect include:

• Identification and contact information: name, role, company, email, telephone number, business address.
• Engagement information: information about your company, its R&D activities and expenditure, financial statements, payroll summaries, contractor arrangements, technical documentation, grant agreements and any other supporting documents you provide.
• Correspondence: notes, emails, meeting records and other communications between you and Overlander Capital.
• Website information: information you submit through the Discovery Questionnaire and contact forms, including any files you upload.
• Technical information: technical data captured automatically when you interact with the Website (such as IP address, browser type, pages viewed and timestamps). Where this information can identify an individual it is treated as personal information.

3.How we collect it

We collect personal information directly from you when you contact us, submit information through the Website, engage us for consulting services, or otherwise communicate with us. We may also collect personal information from third parties who are authorised by you to provide it (such as your registered tax agent, employer or professional services firms acting on your behalf), and from publicly available sources where relevant to an engagement.

Where personal information is collected indirectly, we take reasonable steps to make individuals aware of the collection consistent with APP 5.

4.Why we collect it

We collect, hold, use and disclose personal information to:

• provide consulting services to clients in connection with the R&D Tax Incentive program;
• assess and respond to enquiries received through the Website;
• prepare and lodge R&D Tax Incentive registrations, ATO R&D schedules and related supporting materials;
• manage our business operations, billing, engagement records and internal administration;
• comply with applicable laws, regulatory obligations and lawful requests from government authorities; and
• communicate with clients, prospects and professional contacts about matters relevant to our services.

5.Sensitive information

We do not generally collect sensitive information within the meaning of the Privacy Act, including information about racial or ethnic origin, political opinions, religious beliefs, membership of professional or trade associations, sexual orientation, criminal records, biometric data or health information.

Where sensitive information is incidentally provided through documents you submit (for example, payroll summaries that include union membership or health-fund deductions, or contractor records that include date-of-birth), we treat it as sensitive information and handle it with additional care, including limited internal access, secure storage and restricted disclosure.

6.Anonymity and pseudonymity

Where it is lawful and practicable, you have the option of not identifying yourself, or of using a pseudonym, when dealing with Overlander Capital. This option is not available in respect of our consulting engagements, which by their nature require identifying client and project information for the preparation of R&D Tax Incentive registrations and related materials, and for the firm to comply with its own record-keeping and legal obligations.

7.Who we share it with

We do not sell personal information. We may share personal information with the following categories of recipient where reasonably necessary for the purposes set out in this Policy and only to the extent permitted by law:

• Tax agents and professional services firms engaged by or on behalf of the client, where required for review, lodgement or ongoing compliance.
• Related entities of Overlander Capital where required for the delivery of the consulting services, on the basis that each related entity is bound by equivalent confidentiality obligations.
• Professional services providers engaged by us (such as IT and cloud service providers, document storage providers and other infrastructure providers), on terms consistent with this Policy.
• AusIndustry, the Australian Taxation Office or other government bodies, where required by law or by the rules of the R&D Tax Incentive program.
• Other third parties where required or authorised by law (for example, in response to a subpoena, court order or lawful regulatory request).

8.Cross-border disclosures

Some of the service providers we use to support our business — including IT infrastructure, document storage, communication and analytics tools — may store data on servers located outside Australia, typically in the United States or European Union.

Where we disclose personal information to overseas recipients, we take reasonable steps to ensure they handle that information consistently with the Australian Privacy Principles, including by selecting reputable providers and entering into contractual arrangements that contain appropriate data-handling obligations. By using the Website or providing personal information to Overlander Capital, you consent to this disclosure on the terms set out in this Policy.

9.How we hold and secure it

Personal information is held in secured electronic systems and, where applicable, in secure physical files. We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Measures include access controls, encryption in transit, secured infrastructure, internal access restrictions and ongoing training of personnel.

Access to personal information within Overlander Capital is limited to personnel who require it to perform their role. Where personal information is no longer required and we are not required by law to retain it, we will take reasonable steps to destroy or de-identify it.

10.Notifiable data breaches

Overlander Capital complies with the Notifiable Data Breaches scheme established under Part IIIC of the Privacy Act. If we become aware of an "eligible data breach" — a breach of personal information likely to result in serious harm to any individual whose information is involved, and where remedial action has not prevented that harm — we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

We maintain internal procedures for assessing, containing and remediating any suspected data breach, consistent with OAIC guidance.

11.Use of AI and technology tools

In performing our consulting services, we may use artificial intelligence, machine learning and other technology-enabled tools to assist in the drafting, review, analysis and preparation of documentation and materials. Information submitted through the Website or otherwise provided to us may be processed using such tools as part of preparing responses, drafting and reviewing materials.

We remain responsible for oversight, professional judgment and the security of personal information processed through these tools, and we select tools and providers having regard to that responsibility. We do not knowingly use tools that train their models on confidential client material without our consent.

12.Cookies and analytics

The Website may use cookies and similar technologies to support its operation, remember your preferences, and measure usage in aggregate. You can adjust your browser settings to refuse cookies; in some cases parts of the Website may not function as intended if you do.

We use a privacy-respecting analytics tool that aggregates usage data and does not, of itself, identify individual visitors. Aggregated analytics data is used to improve the Website and is not combined with personal information for any other purpose without your consent.

13.Direct marketing

We may from time to time send you information about our services, market updates relevant to the R&D Tax Incentive program, or other communications we believe may be of interest. You can opt out of receiving these communications at any time by using the unsubscribe link in any such email, or by contacting us using the details below.

We do not sell, rent or trade personal information for direct marketing purposes, and we do not use sensitive information for direct marketing without express consent.

14.Access and correction

You may request access to the personal information we hold about you, and may ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, contact us using the details below. We will respond within a reasonable timeframe and there is no charge for making a request, although a reasonable charge may apply for providing access where the request is large or complex. Where we refuse access or correction we will explain why in writing.

15.Complaints

If you believe Overlander Capital has breached the Australian Privacy Principles or this Policy, please contact us using the details below. We will investigate your complaint and respond within a reasonable timeframe (typically 30 days). If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

16.Changes to this policy

We may update this Privacy Policy from time to time. The current version is the version published on this Website, with the date and version indicated at the top of the page. Where a change materially affects how we handle personal information, we will take reasonable steps to notify clients and other affected individuals. Your continued use of the Website or our services after any change constitutes acceptance of the updated Policy.

17.Contact

If you have questions about this Privacy Policy, the personal information we hold about you, or how Overlander Capital handles personal information generally, please contact us:

Overlander Capital Pty Ltd (ACN 668 746 898)
Attention: Privacy Officer
278 Barker Road, Subiaco WA 6008, Australia
Email: admin@overlandercapital.com